01Local inputs
Processed on-device
The per-user service parses supported session files locally. Setup and repair state, local controls, and secret material remain on the device.
- Supported source files
- Setup and repair state
- Daemon secret storage
APACHE-2.0 / LOCAL RUNTIME
Inspect the code on your Mac before you trust it.
Ottto open-sources the local daemon, CLI, connector contracts, SDK, testkit, and release tooling. Audit what they read, what they can send, and which actions need approval.
Apache-2.0 runtime · no Ottto account needed to inspect, build, or test
Local runtime
ottto-serviceRead on-deviceSupported agent data and source state
Enforce policyValidate schema, exclude blocked fields, check consent
Sync permitted recordsDerived usage after device connection
Raw promptsResponsesCredentialsAbsolute paths
Not part of local usage uploads under the public privacy contract.
Privacy boundary
Audit what the runtime reads, keeps, and can send.
ottto-service turns supported agent data into derived usage records on your Mac. The public privacy contract excludes raw prompts, responses, tool and command output, cookies, credentials, and absolute paths from upload.
02Connection required
Permitted records
After device connection, sync may include timestamps, usage totals, model usage, hashed workspace identity, and display-safe account or plan evidence.
- Policy-checked usage records
- Path-free collector health
- Revocable device connection
03Explicit opt-in
Separate data paths
Diagnostics upload is explicit. Live telemetry and sensitive or networked collectors keep their own setup, policy, and consent gates.
- Diagnostics upload
- Live telemetry setup
- Experimental collectors
Need the field-level rules?Audit privacy.md ↗
Open-source boundary
The runtime is open. The cloud product is operated by Ottto.
The Apache-2.0 repository covers software and safety contracts on customer machines. Ottto separately operates accounts, analytics, Advisor, and the web product.
PUBLIC · APACHE-2.0
The local runtime
Inspect, build, test, and contribute to code that runs on customer machines.
DaemonPer-user serviceCLITyped JSON controls ConnectorsManifests + policiesSDK + testkitSchemas + boundary tests Release toolingManifests + provenancePublic docsInstall, privacy, lifecycle
Inspect ottto-ai/ottto ↗ HOSTED BY OTTTO
The hosted product
A managed service turns permitted records into account-level and cross-account views, analysis, and guidance.
Account + authManaged accessAnalyticsCross-account views AdvisorEvidence-backed guidanceWeb productDashboards + workflows
These services are operated separately from the Apache-2.0 runtime.
Machine-readable connector contracts
A connector declares its access before it runs.
Public source packages ship source and collector manifests, policy docs, and safe fixtures. Identity, capabilities, default state, maturity, risks, and raw-content policy are available for review and validation.
01
Validate the contract.ottto-connector-sdk checks schema versions, IDs, capabilities, and policy vocabulary.
02
Test emitted data.ottto-connector-testkit checks manifests, safe fixtures, upload boundaries, and forbidden raw keys.
03
Learn from first-party packages.Codex, Claude Code, and Pi show concrete source and collector patterns.
# Representative fields — consult the current public manifest schema_version = "collector_manifest.v1" source_id = "claude_code" collector_id = "otel_config" data_source_kind = "live_telemetry" default_state = "requires_setup" maturity = "writes_config" risk_classes = ["network_calls"] uploads_raw_content = false # Illustrative test invocation — confirm current targets in docs $ cargo test --manifest-path crates/Cargo.toml \ -p ottto-connector-testkit --test first_party_sources
Typed runtime controls
One control path for people and automation.
The public CLI and per-user daemon communicate through a typed local protocol. JSON output gives people, CI jobs, and coding agents one interface for setup, status, verification, repair, diagnostics, updates, and uninstall.
Browser-based account claimThe CLI never asks for an Ottto password in the terminal.
One service ownerHomebrew and the app coordinate ownership instead of silently taking over.
Explicit repair authorityConfiguration and credential-adjacent actions keep separate approval rules.
JSON for automationMachine-readable commands support diagnostics, CI, and coding agents.
# Example flow — confirm current commands in the install docs $ brew install ottto-ai/tap/ottto $ brew services start ottto # Read-only JSON checks for humans and agents $ ottto status --json $ ottto verify --app codex --json $ ottto doctor --json # Mutating repair remains an explicit command $ ottto fix --app codex --json
Release provenance
Trace a stable download back to source.
The stable-channel manifest links artifacts to SHA-256 checksums, build provenance, and a CycloneDX SBOM. Verify the download, then inspect its materials and build record.
01Public sourceReview runtime and release code→ 02Release manifestResolve each artifact and checksum→ 03SBOM + provenanceInspect materials and build records
Stable-channel links resolve the current release; this page does not freeze a version.
Open provider intelligence
Track provider changes outside a vendor dashboard.
AI Provider Watch is an account-free feed and CLI for changes to pricing, quotas, token accounting, models, defaults, deprecations, incidents, and migration risk. Its schemas, GitHub Action, MCP helpers, and docs are public, too.
PRICEPricing and token accountingReview cost changes with source evidence.
QUOTALimits and defaultsCatch shifts that change capacity or behavior.
RISKIncidents and deprecationsTurn provider events into migration and reliability work.
# Example flow — confirm current commands in the public docs $ uvx --from ai-provider-watch apw latest --limit 3 # Review changes across the last 30 days $ uvx --from ai-provider-watch apw diff --since 30d # Validate the bundled schemas and feeds $ uvx --from ai-provider-watch apw validate $ uvx --from ai-provider-watch apw index --check
Start with evidence
Audit the boundary. Then decide.
Read the privacy contract, inspect connector manifests, and follow release provenance. Install when the local boundary fits; connect an account only if you want Ottto-operated analytics, Advisor, and the web product.
Open daemon, CLI, connectors, SDK/testkit, release tooling, and docs · hosted account, analytics, Advisor, and web product operated by Ottto